ANS-C01 Question 25
Select 2Your organization operates a hybrid cloud environment. You need to design a DNS solution that allows on-premises systems to resolve AWS-hosted private resources within a VPC while also resolving public domain names. The solution should ensure low-latency name resolution and minimize administrative overhead. Which combination of solutions should you implement?
- A
Use an AWS Route 53 Private Hosted Zone to host the private DNS records for the VPC and configure a Route 53 Resolver inbound endpoint to allow on-premises systems to query the hosted zone.
- B
Configure Amazon Route 53 Resolver outbound endpoints in the VPC to forward DNS queries for public domains to an external DNS server.
- C
Deploy an on-premises DNS server and configure it to forward all DNS queries to Route 53 Resolver inbound endpoints.
- D
Configure AWS Route 53 Public Hosted Zones for the private DNS records and set up a DNS forwarding rule on the on-premises DNS server to forward all queries to Route 53.
- E
Use AWS Direct Connect with a custom DNS server hosted in the VPC to handle both private and public DNS queries from on-premises systems.
Show answer and explanation
Correct answers: A, B
Explanation
The optimal solution for hybrid DNS resolution involves using a Route 53 Private Hosted Zone for private DNS records within the VPC and configuring Route 53 Resolver endpoints for seamless communication between on-premises and AWS-hosted resources. By using both inbound and outbound endpoints, you can ensure low-latency resolution for private and public domains without exposing private records or introducing unnecessary complexity.
- A. Correct.
This is correct. A Route 53 Private Hosted Zone can be used to manage private DNS for VPC resources, and a Route 53 Resolver inbound endpoint allows on-premises systems to query these records.
- B. Correct.
This is correct. Route 53 Resolver outbound endpoints enable forwarding of DNS queries for public domains from the VPC to external DNS servers, ensuring queries for both private and public domains are handled appropriately.
- C. Incorrect.
This is partially correct but not optimal. While an on-premises DNS server could forward queries to the inbound endpoint, it adds unnecessary complexity and administrative overhead compared to a fully managed Route 53 solution.
- D. Incorrect.
This is incorrect. Route 53 Public Hosted Zones are designed for public DNS records, not private VPC resources. Using this would expose private DNS records to the public.
- E. Incorrect.
This is incorrect. While Direct Connect provides a dedicated connection, it does not inherently solve DNS resolution requirements, and hosting a custom DNS server increases administrative overhead unnecessarily.